Extracted

• • Target

    polishclub.exe

  • Size

    34KB

  • MD5

    8a1e00f00d6ac52747aa1dbeeb6afe8f

  • SHA1

    8628de10d78a09956d1af140ba9ef3ebd19c02b1

  • SHA256

    cfe0edec47b69e6806e6d19a7aab72b4c952efd5ca993e64ee3da44a99456a4d

  • SHA512

    dec65379bdd78d6c35e1669e33a6acf1bb6666ab594ce9fc88b50e222fc356601ac84b918eabe74538d349067060fdc143ed4f77005a103947908cb3b015fde6

  • SSDEEP

    384:ASyXlquOae6oKoBmoDnnGvBLmlgCwvHixdTD2VR8pkFTBLTIZwYGDcvw9IkuisRN:3yXiBDAtYgC4CaV9FZ9jENLOjho/4g

  Score

  10^/10

  xwormrattrojanstormkittybootkitdiscoverypersistenceransomwarespywarestealer

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Enumerates processes with tasklist

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4